[client] Treat a named upload URL as a request to upload in the privilege gate

DebugBundle uploads when either the upload flag or the upload URL is set, but
the privilege gate was told only about the flag. With an MDM policy pinning the
destination the gate blanks the caller's URL, so a request carrying a URL and no
flag reached the empty-URL branch and found upload false: nothing to weaken, let
it through. The daemon then uploaded as root with TLS verification disabled on
behalf of an unprivileged caller.

A client older than the upload flag sends exactly that shape, a URL and nothing
else, so this needs no crafted request to reach.

The gate now derives the upload intent from the URL rather than trusting the
caller's flag, and DebugBundle computes it once so the gate and the local-only
early return cannot drift apart.

client/server/debug_gate.go

@@ -58,6 +58,13 @@ func uiLogOpener(id ipcauth.Identity, identified bool) debug.LogOpener {
 // that was going to the pinned host anyway into a refusal. Transport security
 // still is gated: relaxing TLS towards the pinned host is a real weakening.
 func requirePrivilegeForUploadURL(ctx context.Context, rawURL string, insecure, upload, mdmPinned bool) error {
+	// A named URL is itself a request to upload, since DebugBundle uploads when
+	// either the flag or the URL is set and a client older than the flag sends
+	// only the URL. Derived here rather than taken on trust from the caller:
+	// blanking rawURL below would otherwise turn an absent flag into "no upload
+	// to weaken" and let an unprivileged caller relax TLS on a root-run upload.
+	upload = upload || rawURL != ""
+
 	if mdmPinned {
 		rawURL = ""
 	}